-
Notifications
You must be signed in to change notification settings - Fork 3
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add cleanup policies for Artifact Registry #297
Comments
I was wondering if something like - "Delete artifacts older than 30 days but keep 5 most recent versions" would work? Any suggestions @AlexCLeduc / @Stephen-ONeil ? |
Sounds good to me. My only immediate concern was that we may lose (easy) access to vulnerability scan reports for deleted images, which we may need to hold on to for auditing. I dug through some docs and it seems vulnerability scan reports are stored in a project-level Grafeas database where general project metadata goes. Didn't find anything about the retention time of records there, or if deleting the images cascades to delete their metadata too (unlikely?), but I did find audit logs for each vulnerability record creation, associated to the scanned image's URI. Worst case, we have those retained for our standard audit log storage period so we can answer questions like "were you potentially vulnerable to CVE xxx during time period yyy," even if we've already deleted the image 👍 |
Great catch, thanks for looking into this :) |
Clean up policies can be configured for automatically deleting artifact versions that we no longer need or keeping artifacts that we want to store indefinitely.
This should be implemented as part of the artifact registry's IaD configuration.
Documentation: https://cloud.google.com/artifact-registry/docs/repositories/cleanup-policy
The text was updated successfully, but these errors were encountered: